RCMS Cheat Sheet 2026

The 30 highest-yield RCMS facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the 'tipping off' prohibition in AML law? → Prohibition against informing a customer or subject that a SAR has been filed about them
2. Which practice best addresses the risk of vendor lock-in from a compliance continuity perspective? → Maintaining portability of data and documented exit strategies in contracts
3. A company transfers its cybersecurity risk exposure by purchasing a cyber-liability insurance policy. Which risk response strategy does this represent? → Risk transfer
4. Which document records risk identification and evaluation? → Risk register.
5. When a compliance officer faces pressure from management to ignore a regulatory violation to avoid reputational damage, the BEST ethical course of action is to: → Document the pressure and escalate through established reporting channels
6. What is 'fourth-party risk' in the context of third-party compliance management? → Risk from vendors used by your direct third-party vendors
7. Which U.S. government agency administers export controls under the Export Administration Regulations (EAR)? → Department of Commerce (BIS)
8. What is a whistleblower in corporate governance? → Someone reporting misconduct.
9. Which financial statement fraud scheme involves recording revenue that has not been earned? → Fictitious revenue scheme
10. A compliance officer is tasked with validating a third-party vendor's compliance controls. Which approach is MOST appropriate? → Conduct an on-site review or request detailed evidence of control operation
11. Which of the following is the best example of a detective control in a fraud prevention framework? → Surprise audits of petty cash funds
12. Under GDPR, what is the maximum fine for the most serious violations? → €20 million or 4% of global annual turnover
13. Which of the following qualifies as 'sensitive personal data' under GDPR Article 9, requiring explicit consent or another specific basis? → Biometric data used for unique identification
14. A compliance officer receives a subpoena request from a foreign government for records of a U.S. sanctions investigation. What is the primary concern? → Risk of violating anti-boycott regulations under the EAR
15. Which OFAC enforcement action involves a monetary penalty issued without a formal administrative hearing when the party does not contest the findings? → Agreed settlement (settlement agreement)
16. Under the U.S. Federal Sentencing Guidelines, which factor most significantly reduces an organization's culpability score after a compliance violation? → Implementing an effective compliance and ethics program prior to the offense
17. A company appoints a Data Protection Officer (DPO) under GDPR. Which of the following tasks falls OUTSIDE the DPO's role? → Making final decisions on data processing legal bases
18. Which internal control is MOST effective at detecting unauthorized changes made to master vendor file data? → Conducting periodic reconciliations of vendor file changes to an authorized change log
19. Which of the following scenarios best illustrates a 'related-party transaction' requiring board-level disclosure? → A company awards a consulting contract to a firm owned by the CEO's spouse
20. Under the Dodd-Frank Act, which entities are required to file annual compliance reports with their applicable regulator? → Swap dealers and major swap participants registered with the CFTC
21. What role does a compliance officer play? → Overseeing compliance activities.
22. What is the primary purpose of a 'lessons learned' review at the conclusion of a compliance investigation? → To identify systemic weaknesses and improve future compliance controls
23. What is the primary legal protection afforded to internal whistleblowers under SOX Section 806? → Protection from termination, demotion, or harassment for reporting suspected fraud
24. Under the IRS whistleblower program, awards are available for information leading to the collection of unpaid taxes exceeding what threshold? → $2 million in disputed amounts
25. Under the Bank Secrecy Act, what is the minimum threshold for filing a Currency Transaction Report (CTR)? → $10,000
26. An organization wants to assess concentration risk in its vendor portfolio. What does concentration risk refer to in this context? → Over-reliance on a single vendor or vendor type for critical functions
27. What is the primary purpose of including audit rights in a third-party vendor contract? → To allow the company to verify the vendor's compliance with agreed standards
28. Which of the following best describes a key competency required for third-party compliance management in RCMS practice? → Strong analytical skills combined with effective communication and ethical judgment
29. Which international standard provides a framework specifically for anti-bribery management systems? → ISO 37001
30. A compliance officer is building a policy review schedule. What is the MOST important trigger for an unscheduled policy review? → A significant change in applicable law or regulation